# anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk: Anthropic MCP Design Vulnerability Enables RCE: 200k+ Servers at Risk

> Anthropic MCP Design Vulnerability Enables RCE: 200k+ Servers at Risk is a critical-severity remote code execution issue in MCP SDK, a MCP server. Affected: MCP SDK (all languages), STDIO transport pre-patch.

- **Canonical URL:** https://catalog.anomity.ai/vuln/anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk
- **Aliases:** ti-011
- **Severity:** critical
- **Attack type:** Remote code execution, Supply chain compromise
- **Component:** MCP SDK (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-04-15
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk

## Summary

OX Security disclosed a systemic vulnerability baked into Anthropic's official MCP SDK across Python, TypeScript, Java, and Rust. Unsafe defaults in STDIO transport allow arbitrary command execution on any system running a vulnerable MCP implementation, granting attackers access to user data, databases, API keys, and chat histories. Over 7,000 publicly accessible servers and packages totaling 150M+ downloads are affected. 14 CVEs assigned across LiteLLM, LangFlow, Flowise, DocsGPT, and GPT Researcher. Anthropic declined to modify the protocol, citing the behavior as "expected."

## Affected versions

| Affected | Fixed in |
| --- | --- |
| MCP SDK (all languages), STDIO transport pre-patch | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run MCP SDK (all languages), STDIO transport pre-patch.

## How do I fix it?

Audit MCP server configurations for STDIO transport exposure. Update affected MCP packages (LiteLLM, LangFlow, Flowise). Implement input validation on all MCP tool inputs. Restrict MCP server network access to trusted endpoints only.

## How do I find every machine running MCP SDK?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run MCP SDK and which version, then enforce a policy on it.

## References

- article: https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/

## Related vulnerabilities

- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2025-49596](https://catalog.anomity.ai/vuln/cve-2025-49596) — critical
- [CVE-2026-32871](https://catalog.anomity.ai/vuln/cve-2026-32871) — critical
- [CVE-2026-96620](https://catalog.anomity.ai/vuln/cve-2026-96620) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk